Persist verificationId for staff certificates

Add support for verificationId throughout the certificate flow: schema, GraphQL mutations/queries, domain, repositories, service implementation, and UI.

- Backend: add verificationId to Certificate schema and include it in upsert/create mutations; add auth insecureReason notes to related connector operations.
- Data layer: add verificationId parameter to StaffConnectorRepository API and propagation in implementation (SDK call remains commented with FIXME until dataconnect SDK is regenerated).
- Domain: add verificationId field to StaffCertificate (constructor, copyWith, props).
- Certificates flow: create verification via verificationService, pass returned verificationId to upsertStaffCertificate so the verification record is persisted with the certificate.
- UI: update certificate upload page to show existing file path, disable editing of name/issuer/number, rearrange fields, move remove button, change file icon and text style.
- Misc: minor lambda formatting cleanup in benefits mapping.

Note: the generated dataconnect SDK must be refreshed to enable the new .verificationId(...) call (there is a commented FIXME in the connector implementation).

apps/mobile/packages/data_connect/lib/src/connectors/staff/data/repositories/staff_connector_repository_impl.dart

@@ -196,20 +196,17 @@ class StaffConnectorRepositoryImpl implements StaffConnectorRepository {
           .listBenefitsDataByStaffId(staffId: staffId)
           .execute();
 
-      return response.data.benefitsDatas
-          .map(
-            (dc.ListBenefitsDataByStaffIdBenefitsDatas e) {
-              final total =
-                  e.vendorBenefitPlan.total?.toDouble() ?? 0.0;
-              final remaining = e.current.toDouble();
-              return domain.Benefit(
-                title: e.vendorBenefitPlan.title,
-                entitlementHours: total,
-                usedHours: (total - remaining).clamp(0.0, total),
-              );
-            },
-          )
-          .toList();
+      return response.data.benefitsDatas.map((
+        dc.ListBenefitsDataByStaffIdBenefitsDatas e,
+      ) {
+        final total = e.vendorBenefitPlan.total?.toDouble() ?? 0.0;
+        final remaining = e.current.toDouble();
+        return domain.Benefit(
+          title: e.vendorBenefitPlan.title,
+          entitlementHours: total,
+          usedHours: (total - remaining).clamp(0.0, total),
+        );
+      }).toList();
     });
   }
 
@@ -574,6 +571,7 @@ class StaffConnectorRepositoryImpl implements StaffConnectorRepository {
     String? issuer,
     String? certificateNumber,
     domain.StaffCertificateValidationStatus? validationStatus,
+    String? verificationId,
   }) async {
     await _service.run(() async {
       final String staffId = await _service.getStaffId();
@@ -590,6 +588,7 @@ class StaffConnectorRepositoryImpl implements StaffConnectorRepository {
           .issuer(issuer)
           .certificateNumber(certificateNumber)
           .validationStatus(_mapToDCValidationStatus(validationStatus))
+          // .verificationId(verificationId) // FIXME: Uncomment after running 'make dataconnect-generate-sdk'
           .execute();
     });
   }

apps/mobile/packages/data_connect/lib/src/connectors/staff/domain/repositories/staff_connector_repository.dart

@@ -97,6 +97,7 @@ abstract interface class StaffConnectorRepository {
     String? issuer,
     String? certificateNumber,
     StaffCertificateValidationStatus? validationStatus,
+    String? verificationId,
   });
 
   /// Deletes a staff certificate.